This commit is contained in:
Tomer Alpert 2018-04-10 08:23:55 +00:00
parent 0d49b10d63
commit cf9ef65dc1

View File

@ -75,7 +75,7 @@ ProcessCreationEvents
| where ProcessCommandLine == "net stop MpsSvc"
| limit 10
// Better query - filters on filename, does case-insnsitive matches
// Better query - filters on filename, does case-insensitive matches
ProcessCreationEvents
| where FileName in~ ("net.exe", "net1.exe") and ProcessCommandLine contains "stop" and ProcessCommandLine contains "MpsSvc"